I would like to know if its possible to test blind XSS via a cookie value. That is I send the server some cookie that has a blind XSS payload. Or is blind XSS only exploitable if a human interacts with my payload for instance through a web form?

  • XSS is only exploitable if it is executed on a machine that already has privileges. If sending the cookie to the server from your own machine, and you somehow exploit something, that's not considered cross site scripting, instead it would be something else entirely. – Matthew Feb 21 at 13:33
  • @Mattew DOM XSS via cookies could for example be exploited by setting a cookie from a subdomain of the target – Enos D'Andrea Feb 21 at 13:46

Put simply, blind XSS is a form of XSS where the adversary cannot access the endpoint where the payload is stored/executed. The important property of XSS that is relevant to your question is that the payload consists of client-side code.This means in order for the payload to execute, a client must render the DOM containing the malicious payload. This so called "client" could be an unsuspecting user or might go as far as being a headless browser triggering the code.

Based on personal experience as a bug bounty hunter, blind XSS most commonly occurs via submission forms where the payload is stored in a dashboard which an employee can then access. [1] That being said, there have been plenty of cases where the payload is injected via the User-Agent, Referer, etc. headers and then stored in a fancy HTML log somewhere on the company's infrastructure. At the end of the day, if the application is storing data unescaped somewhere, blind XSS becomes a plausible attack vector. Maybe placing an XSS payload in your cookie might trigger an error that is stored somewhere unescaped. ¯\_(ツ)_/¯

On a side note, if you are planning on hunting for blind XSS vulnerabilities in the context of a bug bounty program, for instance, I would highly recommend using XSSHunter and experimenting a bit. If someone triggers your payload, you will receive a pingback from XSSHunter notifying you where your payload ended up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.